Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
1485655eddec3797d0d4e3eac52d11bc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1485655eddec3797d0d4e3eac52d11bc.exe
Resource
win10v2004-20231215-en
General
-
Target
1485655eddec3797d0d4e3eac52d11bc.exe
-
Size
1.0MB
-
MD5
1485655eddec3797d0d4e3eac52d11bc
-
SHA1
3a2b3318b5114cd0fac594af6e178eacc8cd3f1e
-
SHA256
161546849fbffcf6829641f4f44c71739f89144876a684657133f2e6bb2bd140
-
SHA512
6d4ef5d23f2692a05bb61dcf0e285134d00a20223d49eab599b2fdb558ba57a04b10c005ba6daa9d1dc0ea58573670f154bebdcbc0277aad0eb4d9559c2c18de
-
SSDEEP
12288:fMiy4IadS4ms5I6e66fEheKhWsTCxef7cXYgvikavS+skI9rvMQQw6t9y8Yon:fbSaE4mvt/bJcjcXYgKzskIG5n
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 1485655eddec3797d0d4e3eac52d11bc.exe -
Executes dropped EXE 2 IoCs
pid Process 2436 File.exe 324 eicabfiaccj.exe -
Loads dropped DLL 2 IoCs
pid Process 2436 File.exe 2436 File.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4548 324 WerFault.exe 93 -
NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x0008000000023134-21.dat nsis_installer_1 behavioral2/files/0x0008000000023134-21.dat nsis_installer_2 behavioral2/files/0x0008000000023134-31.dat nsis_installer_1 behavioral2/files/0x0008000000023134-31.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 1485655eddec3797d0d4e3eac52d11bc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 1485655eddec3797d0d4e3eac52d11bc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 5c000000010000000400000000080000190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b816800000001000000000000007e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8122000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 1485655eddec3797d0d4e3eac52d11bc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2232 1485655eddec3797d0d4e3eac52d11bc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2232 1485655eddec3797d0d4e3eac52d11bc.exe Token: SeIncreaseQuotaPrivilege 3500 wmic.exe Token: SeSecurityPrivilege 3500 wmic.exe Token: SeTakeOwnershipPrivilege 3500 wmic.exe Token: SeLoadDriverPrivilege 3500 wmic.exe Token: SeSystemProfilePrivilege 3500 wmic.exe Token: SeSystemtimePrivilege 3500 wmic.exe Token: SeProfSingleProcessPrivilege 3500 wmic.exe Token: SeIncBasePriorityPrivilege 3500 wmic.exe Token: SeCreatePagefilePrivilege 3500 wmic.exe Token: SeBackupPrivilege 3500 wmic.exe Token: SeRestorePrivilege 3500 wmic.exe Token: SeShutdownPrivilege 3500 wmic.exe Token: SeDebugPrivilege 3500 wmic.exe Token: SeSystemEnvironmentPrivilege 3500 wmic.exe Token: SeRemoteShutdownPrivilege 3500 wmic.exe Token: SeUndockPrivilege 3500 wmic.exe Token: SeManageVolumePrivilege 3500 wmic.exe Token: 33 3500 wmic.exe Token: 34 3500 wmic.exe Token: 35 3500 wmic.exe Token: 36 3500 wmic.exe Token: SeIncreaseQuotaPrivilege 3500 wmic.exe Token: SeSecurityPrivilege 3500 wmic.exe Token: SeTakeOwnershipPrivilege 3500 wmic.exe Token: SeLoadDriverPrivilege 3500 wmic.exe Token: SeSystemProfilePrivilege 3500 wmic.exe Token: SeSystemtimePrivilege 3500 wmic.exe Token: SeProfSingleProcessPrivilege 3500 wmic.exe Token: SeIncBasePriorityPrivilege 3500 wmic.exe Token: SeCreatePagefilePrivilege 3500 wmic.exe Token: SeBackupPrivilege 3500 wmic.exe Token: SeRestorePrivilege 3500 wmic.exe Token: SeShutdownPrivilege 3500 wmic.exe Token: SeDebugPrivilege 3500 wmic.exe Token: SeSystemEnvironmentPrivilege 3500 wmic.exe Token: SeRemoteShutdownPrivilege 3500 wmic.exe Token: SeUndockPrivilege 3500 wmic.exe Token: SeManageVolumePrivilege 3500 wmic.exe Token: 33 3500 wmic.exe Token: 34 3500 wmic.exe Token: 35 3500 wmic.exe Token: 36 3500 wmic.exe Token: SeIncreaseQuotaPrivilege 4112 wmic.exe Token: SeSecurityPrivilege 4112 wmic.exe Token: SeTakeOwnershipPrivilege 4112 wmic.exe Token: SeLoadDriverPrivilege 4112 wmic.exe Token: SeSystemProfilePrivilege 4112 wmic.exe Token: SeSystemtimePrivilege 4112 wmic.exe Token: SeProfSingleProcessPrivilege 4112 wmic.exe Token: SeIncBasePriorityPrivilege 4112 wmic.exe Token: SeCreatePagefilePrivilege 4112 wmic.exe Token: SeBackupPrivilege 4112 wmic.exe Token: SeRestorePrivilege 4112 wmic.exe Token: SeShutdownPrivilege 4112 wmic.exe Token: SeDebugPrivilege 4112 wmic.exe Token: SeSystemEnvironmentPrivilege 4112 wmic.exe Token: SeRemoteShutdownPrivilege 4112 wmic.exe Token: SeUndockPrivilege 4112 wmic.exe Token: SeManageVolumePrivilege 4112 wmic.exe Token: 33 4112 wmic.exe Token: 34 4112 wmic.exe Token: 35 4112 wmic.exe Token: 36 4112 wmic.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2436 2232 1485655eddec3797d0d4e3eac52d11bc.exe 92 PID 2232 wrote to memory of 2436 2232 1485655eddec3797d0d4e3eac52d11bc.exe 92 PID 2232 wrote to memory of 2436 2232 1485655eddec3797d0d4e3eac52d11bc.exe 92 PID 2436 wrote to memory of 324 2436 File.exe 93 PID 2436 wrote to memory of 324 2436 File.exe 93 PID 2436 wrote to memory of 324 2436 File.exe 93 PID 324 wrote to memory of 3500 324 eicabfiaccj.exe 94 PID 324 wrote to memory of 3500 324 eicabfiaccj.exe 94 PID 324 wrote to memory of 3500 324 eicabfiaccj.exe 94 PID 324 wrote to memory of 4112 324 eicabfiaccj.exe 98 PID 324 wrote to memory of 4112 324 eicabfiaccj.exe 98 PID 324 wrote to memory of 4112 324 eicabfiaccj.exe 98 PID 324 wrote to memory of 1876 324 eicabfiaccj.exe 100 PID 324 wrote to memory of 1876 324 eicabfiaccj.exe 100 PID 324 wrote to memory of 1876 324 eicabfiaccj.exe 100 PID 324 wrote to memory of 3360 324 eicabfiaccj.exe 102 PID 324 wrote to memory of 3360 324 eicabfiaccj.exe 102 PID 324 wrote to memory of 3360 324 eicabfiaccj.exe 102 PID 324 wrote to memory of 1148 324 eicabfiaccj.exe 104 PID 324 wrote to memory of 1148 324 eicabfiaccj.exe 104 PID 324 wrote to memory of 1148 324 eicabfiaccj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1485655eddec3797d0d4e3eac52d11bc.exe"C:\Users\Admin\AppData\Local\Temp\1485655eddec3797d0d4e3eac52d11bc.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\eicabfiaccj.exeC:\Users\Admin\AppData\Local\Temp\eicabfiaccj.exe 6-1-1-1-8-2-1-0-9-3-6 KU9IQzUvMjAuMBopUlRBSEdDPScdKUhEU1ZHUEpJOzoqGi5DSEtSSEQ0LjIvNTIfJ0FIRDQtGilPUU48U0JUVkY+NzIyMS0eLlM8T1A/UV5USko8aGtxajQuLnJqdC1EPFBFJ1NOTyU/T1AlRkhATh8uO0pIQ0JGPjc4UTAoc0N6WEprGi5DMDVMVE05QkwaLkMxNSswICZBLTcsMB8nQjM9JC4aKUM0PCUvHy9HT0k+VEJTV05RSU0+PVM8Hy5IUE5ETEBOWURUSzk7Hy9HT0k+VEJTV0xATTw6GilEV0RXU1FMNB0pP1dEXjtLQ0xASz83Hy5HR1FTXzlPSVFSRFE1MB8vS0U7SEpYTk1dVFJDOhopVUw8Kh4uREouNxouUVRGUkhNPFxRP0tCTkVDSE04RD9PUUs8GC1IU1ZPT0hTSEw9O3NybGIaKVFEU01QTUlFRFlPUkRRV0JAWUo6LBouR0g8Q1c9KB0pQ1JeQ1FMQE1AQFk/TUJRUU5TRTs6YFtrcmQYLUNPTktGSUBDXkFOPDgnKysuLTExJjEwICZRQ0dEPDAsMDc1JzAuLDMfLjxNVk5DTDs+XlNIRUM8NCY1KSwvMDQiMDkzJzcsLilPTA==3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get serialnumber4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get version4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get version4⤵PID:1876
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get version4⤵PID:3360
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get version4⤵PID:1148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 8444⤵
- Program crash
PID:4548
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 324 -ip 3241⤵PID:1140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
557KB
MD52bbef6270549cb4505dcb6c2593db77c
SHA1ddce684a1a32fa1bd18c32645851f42756d2b365
SHA2567effe89fb3dcf62ba4b8f17888337e389ce38fe33c821aa4254a81b8ea5e4f8a
SHA5120f6993e4b799922c3abf460b515537dbc52fd6b78535a607a85e0b90b03f13ca4fae9b01e5b0faa80620b70dd5bd6ea49f36f720a0e5b43671a5b4afc868fcff
-
Filesize
486KB
MD535b42b4fbe0cc8d76bf876a7dc210b0d
SHA130e8cd77031e3673cd0405ccaeba1a7dc57ed137
SHA2567b62334b34e009bcffd16df19c2dc0dd945c1d8f2a6abdb62e26ccd13c695a4c
SHA5125d35966458af8ebf684eadc5f2e15ef9a8e0ca1137ec04b04685cff34ab33d83ef3b4759d5466e48c9ded2e2640d9092069f025789a2ff06662afcc50e090aa7
-
Filesize
489KB
MD57c10aee79a20ad5b822f09e196a90f56
SHA14bfaf86eb075c75a4520366c7c107fb42bbba899
SHA256c082d362a3451a723465dfbd6d01ae8e47a700bc9e289e0fd01a268e8b183f49
SHA51272bcee9140d4aca80d65c0ea69bd27a587695db6e8178fd598ea8564e0c55a1ec21e9036bf13fb03e87d7efe09b3b760416c60171a479d6060a0df82af87bf7c
-
Filesize
346KB
MD522e341b5b537fc1b3f3167479552c801
SHA13da42f872d00cac7ebeb1b2a6eacb538a3ea3490
SHA2566f166019d6b2533bceb55a8e157cd6991144e00099838a806ca46b80c7c42a8b
SHA51239487241d019cdeaa10d3d1630e05139916a54155d39d30a0a881c8f19f410cc8f15c941a3755d4d0190b60640b0a1282f3a652de3b2a0bbf6aa8a6ef98ecc17
-
Filesize
125KB
MD5fa201b3a974e89c2698bd733a75f1ca9
SHA1574b335dc91439ecaffaddf305dce5bbfa93cb16
SHA25698ac4f5ba3c5ced121551da176662b0823496058c795b3cdac2291cc2b942ed6
SHA512f7b0b08886d7fd6f1313d8d283e8f5663bd9dd3c59885f8f00de037580475f5a37682dc5a24d5e5ac09c4893dc063e48399d4b5ba248fd085439c0c2651cd09f
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5